Credential Harvesting — 22 posts

Your documents are ready kindly scan the can QR CODE to review and sign. A salary adjustment contract posing as the company's own HR department, sent from the postmaster mailbox of an unrelated domain, styled as DocuSign in the email and OneDrive in the PDF, with the company's name, logo and mailbox merged in — and a QR code as the only way in.

The tax inspection of your company has revealed irregularities under Section 271(1)(c) of the Income Tax Act, 1961. The same forged Income Tax Department notice we dissected a month ago, rewritten to remove its worst mistakes and pointed at a convincing lookalike domain registered in Indonesia.

We are contacting you regarding your expired domain registration. A WordPress.com-branded final warning sent from a German mail server subdomain, whose only button points at a throwaway subdomain of an Italian sports academy.

You have Two (2) Messages Pending Delivery on Your E-mail Portal. A notice claiming to be your own domain's web administrator, sent from an animal-feed company's accounts mailbox, whose button opens a page the attacker uploaded into a Google Cloud Storage bucket.

Your payment has been successfully processed. Please find the attached SWIFT advice and supporting documentation for your records. Four lines of flawless business English, a Re: subject line for a conversation that never happened, and a 140 KB PDF that is the entire attack.

We couldn't renew your Cloud storage subscription because your payment method needs to be updated. A storage-full warning whose body is actually about a failed payment, sent from a domain on a top-level domain that does not exist, linking to a page parked inside a Google Cloud Storage bucket.

We are reaching out to inform you that your domain registration with WordPress.com is approaching its expiration date and requires renewal to maintain active status. A pixel-perfect WordPress.com notice sent from an Italian postmaster mailbox, whose only button points at a German health domain.

Judicial Notice. Case Matter: Tax Dispute / Financeira. Investigating Authority: Renda Tax Department, Government of India. A summons from a tax authority that does not exist, sent from a free Outlook mailbox, still carrying the Portuguese words of the template it was copied from.

Your bank account will be charged $3,520.00. A fake QuickBooks debit alert whose visible Intuit link actually routes through a hijacked mobile-marketing redirect to an attacker-controlled site.

Your document is ready for review. A counterfeit DocuSign notification whose "Review & Sign" button leads to a CDN-hosted credential harvesting page with your own address baked into the link.